Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Filtered Results
915 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2021-1497 |
— | — | 0.9993 | — | KEV | Cisco HyperFlex HX Installer Virtual Machine contains an insufficient input validation vulnerability |
CVE-2021-39226 |
— | — | 0.9993 | — | KEV | Grafana contains an authentication bypass vulnerability that allows authenticated and unauthenticate |
CVE-2021-38647 |
— | — | 0.9993 | — | KEV | Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an uns |
CVE-2023-34362 |
— | — | 0.9993 | — | KEV | Progress MOVEit Transfer contains a SQL injection vulnerability that could allow an unauthenticated |
CVE-2021-26085 |
— | — | 0.9994 | — | KEV | Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources |
CVE-2024-29824 |
— | — | 0.9994 | — | KEV | Ivanti Endpoint Manager (EPM) contains a SQL injection vulnerability in Core server that allows an u |
CVE-2024-27198 |
— | — | 0.9994 | — | KEV | JetBrains TeamCity contains an authentication bypass vulnerability that allows an attacker to perfor |
CVE-2022-22963 |
— | — | 0.9994 | — | KEV | When using routing functionality in VMware Tanzu's Spring Cloud Function, it is possible for a user |
CVE-2014-7169 |
— | — | 0.9994 | — | KEV | GNU Bash through 4.3 processes trailing strings after function definitions in the values of environm |
CVE-2020-10189 |
— | — | 0.9994 | — | KEV | Zoho ManageEngine Desktop Central contains a file upload vulnerability that allows for unauthenticat |
CVE-2025-24813 |
— | — | 0.9994 | — | KEV | Apache Tomcat contains a path equivalence vulnerability that allows a remote attacker to execute cod |
CVE-2021-3129 |
— | — | 0.9994 | — | KEV | Laravel Ignition contains a file upload vulnerability that allows unauthenticated remote attackers t |
CVE-2022-30525 |
— | — | 0.9994 | — | KEV | A command injection vulnerability in the CGI program of some Zyxel firewall versions could allow an |
CVE-2017-11882 |
— | — | 0.9994 | — | KEV | Microsoft Office contains a memory corruption vulnerability that allows remote code execution in the |
CVE-2018-10562 |
— | — | 0.9995 | — | KEV | Dasan GPON Routers contain an authentication bypass vulnerability. When combined with CVE-2018-10561 |
CVE-2023-38035 |
— | — | 0.9995 | — | KEV | Ivanti Sentry, formerly known as MobileIron Sentry, contains an authentication bypass vulnerability |
CVE-2018-15961 |
— | — | 0.9995 | — | KEV | Adobe ColdFusion contains an unrestricted file upload vulnerability that could allow for code execut |
CVE-2022-1388 |
— | — | 0.9995 | — | KEV | F5 BIG-IP contains a missing authentication in critical function vulnerability which can allow for r |
CVE-2020-0688 |
— | — | 0.9996 | — | KEV | Microsoft Exchange Server Validation Key fails to properly create unique keys at install time, allow |
CVE-2022-41040 |
— | — | 0.9996 | — | KEV | Microsoft Exchange Server allows for server-side request forgery. Dubbed "ProxyNotShell," this vulne |
CVE-2024-38475 |
— | — | 0.9996 | — | KEV | Apache HTTP Server contains an improper escaping of output vulnerability in mod_rewrite that allows |
CVE-2018-2628 |
— | — | 0.9996 | — | KEV | Oracle WebLogic Server contains an unspecified vulnerability which can allow an unauthenticated atta |
CVE-2019-10149 |
— | — | 0.9996 | — | KEV | Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to |
CVE-2021-3156 |
— | — | 0.9996 | — | KEV | Sudo contains an off-by-one error that can result in a heap-based buffer overflow, which allows for |
CVE-2021-42013 |
— | — | 0.9996 | — | KEV | Apache HTTP Server contains a path traversal vulnerability that allows an attacker to perform remote |
CVE-2022-47986 |
— | — | 0.9997 | — | KEV | IBM Aspera Faspex could allow a remote attacker to execute code on the system, caused by a YAML dese |
CVE-2020-25506 |
— | — | 0.9997 | — | KEV | D-Link DNS-320 device contains a command injection vulnerability in the sytem_mgr.cgi component that |
CVE-2017-12617 |
— | — | 0.9997 | — | KEV | When running Apache Tomcat, it is possible to upload a JSP file to the server via a specially crafte |
CVE-2025-31161 |
— | — | 0.9997 | — | KEV | CrushFTP contains an authentication bypass vulnerability in the HTTP authorization header that allow |
CVE-2022-41082 |
— | — | 0.9997 | — | KEV | Microsoft Exchange Server contains an unspecified vulnerability that allows for authenticated remote |
CVE-2014-8361 |
— | — | 0.9997 | — | KEV | Realtek SDK contains an improper input validation vulnerability in the miniigd SOAP service that all |
CVE-2025-5777 |
— | — | 0.9997 | — | KEV | Citrix NetScaler ADC and Gateway contain an out-of-bounds read vulnerability due to insufficient inp |
CVE-2025-24893 |
— | — | 0.9997 | — | KEV | XWiki Platform contains an eval injection vulnerability that could allow any guest to perform arbitr |
CVE-2024-4879 |
— | — | 0.9998 | — | KEV | ServiceNow Utah, Vancouver, and Washington DC Now Platform releases contain a jelly template injecti |
CVE-2012-0158 |
— | — | 0.9998 | — | KEV | Microsoft MSCOMCTL.OCX contains an unspecified vulnerability that allows for remote code execution, |
CVE-2021-45046 |
— | — | 0.9998 | — | KEV | Apache Log4j2 contains a deserialization of untrusted data vulnerability due to the incomplete fix o |
CVE-2019-2725 |
— | — | 0.9998 | — | KEV | Injection vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomp |
CVE-2024-24919 |
— | — | 0.9998 | — | KEV | Check Point Quantum Security Gateways contain an unspecified information disclosure vulnerability. T |
CVE-2023-4863 |
— | — | 0.9998 | — | KEV | Google Chromium WebP contains a heap-based buffer overflow vulnerability that allows a remote attack |
CVE-2025-59287 |
— | — | 0.9998 | — | KEV | Microsoft Windows Server Update Service (WSUS) contains a deserialization of untrusted data vulnerab |
CVE-2024-1709 |
— | — | 0.9998 | — | KEV | ConnectWise ScreenConnect contains an authentication bypass vulnerability that allows an attacker wi |
CVE-2025-22457 |
— | — | 0.9998 | — | KEV | Ivanti Connect Secure, Policy Secure, and ZTA Gateways contains a stack-based buffer overflow vulner |
CVE-2025-0282 |
— | — | 0.9998 | — | KEV | Ivanti Connect Secure, Policy Secure, and ZTA Gateways contain a stack-based buffer overflow which c |
CVE-2021-22204 |
— | — | 0.9998 | — | KEV | Improper neutralization of user data in the DjVu file format in Exiftool versions 7.44 and up allows |
CVE-2021-20090 |
— | — | 0.9998 | — | KEV | Arcadyan Buffalo firmware contains a path traversal vulnerability that could allow unauthenticated, |
CVE-2024-45195 |
— | — | 0.9998 | — | KEV | Apache OFBiz contains a forced browsing vulnerability that allows a remote attacker to obtain unauth |
CVE-2023-46805 |
— | — | 0.9998 | — | KEV | Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure gateway |
CVE-2023-29357 |
— | — | 0.9998 | — | KEV | Microsoft SharePoint Server contains an unspecified vulnerability that allows an unauthenticated att |
CVE-2023-22527 |
— | — | 0.9998 | — | KEV | Atlassian Confluence Data Center and Server contain an unauthenticated OGNL template injection vulne |
CVE-2022-40684 |
— | — | 0.9998 | — | KEV | Fortinet FortiOS, FortiProxy, and FortiSwitchManager contain an authentication bypass vulnerability |